In a computing services environment, users gain access to services through networked computing entities, or components, interconnected by segments of the network. A component is a computing entity, such as a server, that is invoked to provide the service, and may interconnect with other servers for providing the service. Flow data derived from transmission activity over the segments is expressed as metrics of performance parameters for the segment. Network health is ascertainable by examining the flow data, and comparing the flow data to a baseline of acceptable or normal operating parameters. Deviation from the baseline indicates substandard status, or health, warranting further investigation. Network health status is often aggregated, or summarized, by grouping flow data covering a set of segments and components. Acceptable status for the aggregated group results in a rendering of an acceptable, or normal, health summary for all the segments in the group. Significant deviation from the baseline for the aggregated group is met with a “drill down” response, which narrows the group in an iterative manner to identify deviant segments.